@bongos/core 1.19.184 → 1.19.185

package/modules/hall-ui/public/shell.js

@@ -98,7 +98,7 @@
   //               current (mirrors the old #hall-nav-work rule, task #833)
   //   archon    — rank === 'archon'
   //   governance — rank is metic or archon (ADR 0157): the monitoring/ops pages.
-  //               Mirrors the server's `page.view.governance` floor, which that ADR
+  //               Mirrors the server's `page.view.government` floor, which that ADR
   //               lowered archon→metic. Cosmetic only — requireGovernancePage is the wall.
   // `view` marks an index view (hash-routed); `module` gates on window.__MODULES__.
   // task 2175: grouped by AUDIENCE of the data, so the sidebar reads in coherent
@@ -178,7 +178,7 @@
       { id: 'sessions', label: 'Sessions', icon: 'admin', href: '/sessions', gate: 'governance' },
       // BV1.R113: the roles-and-permissions tab (ADR 0151). The one genuinely
       // Archon-only item the 'governance' gate comment anticipated — cosmetic
-      // only; requireGovernanceManagePage (the governance.manage atom) is the wall.
+      // only; requireGovernanceManagePage (the government.manage atom) is the wall.
       { id: 'governance', label: 'Roles', icon: 'admin', href: '/governance', gate: 'archon' },
     ] },
   ];
@@ -420,7 +420,7 @@
       case 'member': return member;
       case 'work': return authed && (member || access.showWork);
       case 'archon': return authed && access.rank === 'archon';
-      // ADR 0157: the monitoring/ops pages sit at the `page.view.governance` floor,
+      // ADR 0157: the monitoring/ops pages sit at the `page.view.government` floor,
       // which is metic. Kept as its own key rather than widening 'archon', so a
       // genuinely Archon-only nav item can still be added later.
       case 'governance': return authed && (access.rank === 'metic' || access.rank === 'archon');

package/modules/hall-ui/public/watch.js

@@ -885,7 +885,7 @@
       return;
     }
 
-    // ADR 0157: Watch sits at the `page.view.governance` floor (metic), and every panel
+    // ADR 0157: Watch sits at the `page.view.government` floor (metic), and every panel
     // it reads (roster, security reports, audit log, sessions, box costs) delegated to
     // metic with it. Cosmetic — requireGovernancePage + the route gates are the wall.
     if (!builder || (builder.rank !== 'metic' && builder.rank !== 'archon')) {

package/modules/lifecycle/routes/gate-approvals.js

@@ -68,7 +68,7 @@ module.exports = function buildGateApprovalsRouter() {
   // BV1.R105 left this on requireRank because `gate_approval.decide` was declared over
   // the /approve WRITE only and no atom named the read. ADR 0157 extends the catalog
   // with exactly that atom — `gate_approval.read`, floor metic — so the mapping is now
-  // one the catalog makes. The split is load-bearing, not cosmetic: `page.view.governance`
+  // one the catalog makes. The split is load-bearing, not cosmetic: `page.view.government`
   // opens /gate to Metic, and without a Metic-readable data endpoint that page would
   // render nothing but a 403. Approving a held PR stays archon (`.decide`, system).
   router.get('/gate-approvals', auth.requireBuilder, auth.requirePermission('gate_approval.read'), async (req, res) => {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.184",
+  "version": "1.19.185",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.184",
+      "version": "1.19.185",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.184",
+  "version": "1.19.185",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/publish-manifest.js

@@ -61,7 +61,6 @@ const PUBLISH_ALLOWLIST = [
   'modules/sessions/',
   'modules/autonomy/',
   'modules/security/',
-  'modules/governance/',     // configurable roles & permissions (BV1 goal 1000030, ADR 0151) — the rank/permission machinery publishes AS the open-source methodology (ADR 0065 §4 / ADR 0098); it is in PROTECTED_GLOBS for write-protection, NOT publish-exclusion. default:true. Renamed → modules/government/ (ADR 0174); dropped with the folder in goal 1000068 R04.
   'modules/government/',     // the same machinery under its post-ADR-0174 name (goal 1000068, task 1003003). Added in lockstep with the protected-surfaces.json entry: publish_manifest asserts every PROTECTED_GLOB is either topology-excluded or publishable, so registering the glob as protected WITHOUT this line default-denies the module from the published core — the open-source methodology would silently lose its permission machinery at the next release.
   'modules/hall-ui/',
   'modules/status-ui/',
@@ -213,7 +212,6 @@ const INSTANCE_EXCLUDE = [
   'config/devbox-app.json',
   'config/hierarchy.json',
   'config/government.json',
-  'config/governance.json',   // pre-ADR-0174 spelling — a live instance may still carry one; it is host content and stays denied
   'CODEOWNERS',              // names the owner (a protected surface, excluded as identity)
   // instance SEED migrations — this host's scope-truth SQL (planning seeds, world data).
   // ADR 0105: a consumer's core must not carry them; migrate.sh reads instance seeds from

package/scripts/gds/seed-governance-tasks.js

@@ -216,7 +216,7 @@ const TASKS = [
     title: 'Governance API routes (roles/perms/assignments CRUD)',
     description: `**Why:** the tab's server surface.
 
-**Done when:** routes list roles/permissions/assignments, create a role, toggle an operational permission on a role, and assign a role to a builder — all gated \`governance.manage\` (Archon), system permissions rejected as non-grantable server-side, and pinned in route-rank-check. Depends on R97 + R109.`,
+**Done when:** routes list roles/permissions/assignments, create a role, toggle an operational permission on a role, and assign a role to a builder — all gated \`government.manage\` (Archon), system permissions rejected as non-grantable server-side, and pinned in route-rank-check. Depends on R97 + R109.`,
   },
   {
     ref: 'R111', kind: 'feature', priority: 3, est_minutes: 180, manual_degree: 2, credits_reward: 55,

package/src/bongos/auth.js

@@ -1437,9 +1437,9 @@ function signInWithReturn(req) {
 // ranks (catalog.RANK_ORDER):
 //   requireBuilderPage     was "any session"      floor xenos  → page.view.public
 //   requireNonXenosPage    was rank !== 'xenos'   floor thetes → page.view.builder
-//   requireGovernancePage  was rank === 'archon'  floor archon → page.view.governance
+//   requireGovernancePage  was rank === 'archon'  floor archon → page.view.government
 // That third gate was spelled `requireArchonPage` until ADR 0157 lowered
-// page.view.governance's floor archon→metic and the name stopped being true; the
+// page.view.government's floor archon→metic and the name stopped being true; the
 // floor now lives in modules/government/catalog.js, not in the function's name.
 // The one accepted divergence is the one governance_002 already documents
 // (tests/governance_parity.mjs Part D): a builder on a reserved/divine rank holds
@@ -1456,8 +1456,8 @@ function signInWithReturn(req) {
 const PAGE_GATES = Object.freeze({
   requireBuilderPage: Object.freeze({ permission: 'page.view.public', deniedTo: '/builders' }),
   requireNonXenosPage: Object.freeze({ permission: 'page.view.builder', deniedTo: '/builders/not-ready' }),
-  requireGovernancePage: Object.freeze({ permission: 'page.view.governance', deniedTo: '/builders' }),
-  requireGovernanceManagePage: Object.freeze({ permission: 'governance.manage', deniedTo: '/builders' }),
+  requireGovernancePage: Object.freeze({ permission: 'page.view.government', deniedTo: '/builders' }),
+  requireGovernanceManagePage: Object.freeze({ permission: 'government.manage', deniedTo: '/builders' }),
   requireProjectCuratePage: Object.freeze({ permission: 'project.curate', deniedTo: '/builders' }),
 });
 
@@ -1534,7 +1534,7 @@ async function requireBuilderPage(req, res, next) {
 }
 
 // The /watch monitoring surface, the /harbor dev-box page and the /gate page
-// (#726, idea 257, task 1179) — Metic and up, per `page.view.governance`'s catalog
+// (#726, idea 257, task 1179) — Metic and up, per `page.view.government`'s catalog
 // floor. Named `requireArchonPage` until ADR 0157 lowered that floor archon→metic
 // (older ADRs still use the old name; this line is the trail). Defense-in-depth:
 // every data endpoint these pages call is independently gated server-side, so no
@@ -1545,7 +1545,7 @@ async function requireGovernancePage(req, res, next) {
 }
 
 // The /governance roles-and-permissions tab (BV1.R113) — gated on the
-// `governance.manage` ATOM itself (system, archon floor), the same key every
+// `government.manage` ATOM itself (system, archon floor), the same key every
 // /governance/* data route checks, so the page layer can never drift wider than
 // the API it fronts. Defense-in-depth as above: the data endpoints are all
 // independently gated; this keeps the tab shell from rendering for anyone else.
@@ -1716,7 +1716,7 @@ function requireRank(...allowed) {
 // time — never hardcoded prose, which goes stale when a floor moves (the
 // D-16/N-3 failure shape ADR 0157 left behind).
 //
-// Usage: router.post('/roles', auth.requireBuilder, auth.requirePermission('governance.manage'), handler)
+// Usage: router.post('/roles', auth.requireBuilder, auth.requirePermission('government.manage'), handler)
 function requirePermission(...perms) {
   const required = Object.freeze([...perms]);
   return async function permissionGate(req, res, next) {

package/src/bongos/module-scope-map.js

@@ -174,30 +174,15 @@ const MODULE_GLOBS = {
   //     role templates (R96), listed here as goal territory; the module code lands in
   //     R93+ (the carve precedes the feature — ADR 0086 §4). Written as exact paths,
   //     not 'config/governance*.json' — the touches convention has no wildcards. ---
-  //     RENAMED governance → government (goal 1000068, task 1003003, ADR 0174).
-  //     Both keys live through the transition and BOTH carry BOTH sets of globs,
-  //     so the wall is identical whichever key a goal names and whichever name
-  //     the folder currently has on disk. The `government` key must land BEFORE
-  //     R04 moves the folder: goals carry scope_modules by KEY, so moving the
-  //     folder first would leave goal 1000068's own wall not matching the files
-  //     its remaining tasks need to touch, blocking the rename mid-goal.
-  //     `modules/government/` is registered in protected-surfaces.json in the
-  //     same change — `protected` DERIVES from that registry, so without it this
-  //     key would compute protected:false and silently drop the Archon gate.
+  //     RENAMED governance → government (goal 1000068, ADR 0174). The
+  //     transitional `governance` alias key was removed in R05 (task 1003006)
+  //     together with the /governance/* route aliases — the same compatibility
+  //     window. The three live goals that named the old key (1000030, 1000057,
+  //     1000068) had it removed from goals.scope_modules in the same change, so
+  //     no stored row references a key the map no longer defines.
   government: [
-    'modules/government/', 'modules/governance/',
+    'modules/government/',
     'config/government.json', 'config/government.neutral.json',
-    'config/governance.json', 'config/governance.neutral.json',
-  ],
-  //     DEPRECATED ALIAS — kept for one release so goals and tasks already
-  //     scoped to `governance` keep resolving. Removed by goal 1000068 R05
-  //     (task 1003006), the release that drops the /governance/* route aliases;
-  //     the two removals are the same compatibility window and should land
-  //     together.
-  governance: [
-    'modules/government/', 'modules/governance/',
-    'config/government.json', 'config/government.neutral.json',
-    'config/governance.json', 'config/governance.neutral.json',
   ],
   // --- the two web surfaces ---
   // BV1.R85: hall-UI graduated to modules/hall-ui/ — public-builders/ moved to

package/src/bongos/route-rank-check.js

@@ -231,19 +231,18 @@ const EXPECTED_RANKS = {
   'GET /security/adr': 'metic+archon',
 };
 
-// The authz-core route pins, referenced by BOTH the `governance` and the
-// `government` module keys below while goal 1000068's rename is in flight
-// (ADR 0174, task 1003003). One object, two keys — never two literals.
+// The authz-core route pins (ADR 0174). Paths and the gating atom were renamed
+// governance→government in R05 (task 1003006); the module-key alias is gone.
 const GOVERNMENT_PINS = {
-  'GET /governance/roles': 'perm:governance.manage',
-  'GET /governance/permissions': 'perm:governance.manage',
-  'GET /governance/assignments': 'perm:governance.manage',
-  'POST /governance/roles': 'perm:governance.manage',
-  'PUT /governance/roles/:roleKey/permissions/:permissionKey': 'perm:governance.manage',
-  'DELETE /governance/roles/:roleKey/permissions/:permissionKey': 'perm:governance.manage',
-  'POST /governance/roles/:roleKey/reset': 'perm:governance.manage',
-  'POST /governance/assignments': 'perm:governance.manage',
-  'DELETE /governance/assignments/:builderId/:roleKey': 'perm:governance.manage',
+  'GET /government/ranks': 'perm:government.manage',
+  'GET /government/permissions': 'perm:government.manage',
+  'GET /government/assignments': 'perm:government.manage',
+  'POST /government/ranks': 'perm:government.manage',
+  'PUT /government/ranks/:rankKey/permissions/:permissionKey': 'perm:government.manage',
+  'DELETE /government/ranks/:rankKey/permissions/:permissionKey': 'perm:government.manage',
+  'POST /government/ranks/:rankKey/reset': 'perm:government.manage',
+  'POST /government/assignments': 'perm:government.manage',
+  'DELETE /government/assignments/:builderId/:rankKey': 'perm:government.manage',
 };
 
 // Module-scoped privileged-rank pins: a privileged route that lives in a FEATURE
@@ -417,17 +416,12 @@ const MODULE_EXPECTED_RANKS = {
   },
   // The government tab's server half (BV1.R110, ADR 0151; renamed by ADR 0174) —
   // the routes that EDIT the rank/permission graph itself. Every route, the three
-  // reads included, is pinned to the `governance.manage` ATOM rather than a rank:
+  // reads included, is pinned to the `government.manage` ATOM rather than a rank:
   // on this surface the atom IS the authority (it is the catalog's meta-escalation
   // key), and a downgrade here is the model's worst case — the routes that write
   // authority drifting below the wall that guards authority. Reads are pinned too
   // because the full rank/grant/assignment map is the authority model's blueprint.
   //
-  // The ROUTE PATHS and the `governance.manage` key are renamed by R05 (task
-  // 1003006), not here: R02 only makes the pins reachable under both module keys.
-  // Renaming the paths before the routes move would pin routes that do not exist
-  // and red the build for the whole window.
-  governance: GOVERNMENT_PINS,
   // The same pins under the post-ADR-0174 module name (goal 1000068, task
   // 1003003). Pins are applied only when the module directory is IN SCOPE — at
   // least one route file was discovered under modules/<key>/ — so this entry is

package/src/bongos/serve-internal.js

@@ -749,7 +749,7 @@ function mountInternalSurfaces(app) {
   });
 
   // The /watch monitoring page and the /harbor dev-box management page (idea 257)
-  // and the /gate page (task 1179) all sit behind `page.view.governance` — Metic
+  // and the /gate page (task 1179) all sit behind `page.view.government` — Metic
   // and up since ADR 0157. Same server-side page gate, same posture: a builder
   // without the permission never receives the shell (requireGovernancePage — named
   // requireArchonPage before ADR 0157 — redirects them to the hall, and an
@@ -767,7 +767,7 @@ function mountInternalSurfaces(app) {
   // group without a wall. Gated here so the group is uniform (task 1002710).
   const SESSIONS_PAGE_RE = /^\/builders\/sessions(?:\.html)?\/?$/;
   // The /governance roles-and-permissions tab (BV1.R113) sits one floor higher:
-  // the `governance.manage` atom itself (archon), the same key its data routes
+  // the `government.manage` atom itself (archon), the same key its data routes
   // check — requireGovernanceManagePage, not the metic-floored gate above.
   const GOVERNANCE_PAGE_RE = /^\/builders\/governance(?:\.html)?\/?$/;
   // The /people builder directory (task 1002577): gated on `project.curate`, the

package/src/module-api.js

@@ -390,7 +390,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         ad7a262 and never packaged, so ~104 non-merge commits sat on main
 //         reachable by no pin; this is the artifact that ships them. Headline:
 //         the governance permission system's second half (R110 roles/perms/
-//         assignments CRUD behind governance.manage, R113 the Roles nav +
+//         assignments CRUD behind government.manage, R113 the Roles nav +
 //         page gate, R114 the C6 live proof, ADR 0157 delegating the
 //         operational block from Archon to Metic, and the permission resolve
 //         folded into the session load); the scan-before-install security
@@ -795,8 +795,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.182 with no explicit bump. run 31973728179. (task 1002620)
 //   1.19.184 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.183 with no explicit bump. run 31974847472. (task 1002620)
+//   1.19.185 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.184 with no explicit bump. run 31976564067. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.184'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.185'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/governance_abuse_matrix.mjs

@@ -16,7 +16,7 @@
 //     V3  HTTP: assign a seeded rank-role to a builder (rank is the only writer)
 //     V4  HTTP: mass-assignment on role create (is_system / permissions in body)
 //     V5  HTTP: every write vector 403s outright for a caller without
-//         governance.manage (the low-trust builder's own attempt)
+//         government.manage (the low-trust builder's own attempt)
 //     V6  config: a role template proposing system keys is stripped; a seeded
 //         role's template grants are dropped wholesale; env overrides labels only
 //     V7  session-scope: an allow-list naming a system or principal key THROWS
@@ -109,9 +109,9 @@ test('every system permission floors at archon or is a principal (never seeded l
 const calls = [];
 const stub = {
   getRoleByKey: async (k) => (SEEDED_ROLES.includes(k)
-    ? { role_key: k, label: k, is_system: true, seeded_rank: k }
-    : { role_key: k, label: k, is_system: false, seeded_rank: null }),
-  createRole: async (a) => ({ role_key: a.roleKey, label: a.label, description: a.description ?? null, is_system: false, seeded_rank: null, created_by: a.createdBy, created_at: 't' }),
+    ? { rank_key: k, label: k, is_system: true, seeded_rank: k }
+    : { rank_key: k, label: k, is_system: false, seeded_rank: null }),
+  createRole: async (a) => ({ rank_key: a.rankKey, label: a.label, description: a.description ?? null, is_system: false, seeded_rank: null, created_by: a.createdBy, created_at: 't' }),
   grantRolePermission: async () => true,
   revokeRolePermission: async () => true,
   resetRoleGrants: async ({ permissionKeys }) => permissionKeys.length,
@@ -127,7 +127,7 @@ for (const k of Object.keys(stub)) {
 }
 
 // The attacker holds the MOST privileged legitimate session — an Archon with
-// governance.manage. The matrix must hold even against the admin misusing the
+// government.manage. The matrix must hold even against the admin misusing the
 // API, not just against a low-trust caller (V5 covers that one).
 const realRequireBuilder = api.requireBuilder;
 api.requireBuilder = (req, res, next) => { req.builder = { id: 42, rank: 'archon' }; next(); };
@@ -136,9 +136,9 @@ function grant(keys) {
   seams._reset();
   seams.registerProvider('government', { resolveBuilderPermissions: async () => keys });
 }
-grant(['governance.manage']);
+grant(['government.manage']);
 
-const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'government', 'routes', 'governance.js'));
+const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'government', 'routes', 'government.js'));
 const app = express();
 app.use(express.json());
 app.use(attachFail);
@@ -168,7 +168,7 @@ async function call(method, p, body) {
 
 test('V1: EVERY system permission is refused onto a custom role, before the db', async () => {
   for (const k of SYSTEM_KEYS) {
-    const r = await call('PUT', `/governance/roles/custom-role/permissions/${k}`);
+    const r = await call('PUT', `/government/ranks/custom-role/permissions/${k}`);
     assert.equal(r.status, 400, `${k} must be refused`);
     assert.equal(r.json.error.code, 'permission_not_grantable', k);
     assert.equal(calls.filter(([c]) => c === 'grantRolePermission').length, 0,
@@ -185,15 +185,15 @@ test('V1: EVERY system permission is refused onto a custom role, before the db',
 test('V2a: the ARCHON rank-role refuses EVERY write — grant, revoke and reset alike', async () => {
   for (const k of [...SYSTEM_KEYS, 'idea.triage']) {
     for (const method of ['PUT', 'DELETE']) {
-      const r = await call(method, `/governance/roles/archon/permissions/${k}`);
+      const r = await call(method, `/government/ranks/archon/permissions/${k}`);
       assert.equal(r.status, 403, `archon ← ${method} ${k} must be refused`);
-      assert.equal(r.json.error.code, 'archon_role_immutable', `archon ← ${method} ${k}`);
+      assert.equal(r.json.error.code, 'archon_rank_immutable', `archon ← ${method} ${k}`);
       assert.equal(calls.filter(([c]) => c === 'grantRolePermission' || c === 'revokeRolePermission').length, 0);
     }
   }
-  const r = await call('POST', '/governance/roles/archon/reset');
+  const r = await call('POST', '/government/ranks/archon/reset');
   assert.equal(r.status, 403, 'reset must not be a back door into the archon role');
-  assert.equal(r.json.error.code, 'archon_role_immutable');
+  assert.equal(r.json.error.code, 'archon_rank_immutable');
   assert.equal(calls.filter(([c]) => c === 'resetRoleGrants').length, 0);
 });
 
@@ -201,7 +201,7 @@ test('V2b: EVERY editable rank-role still refuses every SUBSTRATE and PRINCIPAL
   const neverGrantable = [...SUBSTRATE_KEYS, ...catalog.principalKeys()];
   for (const role of EDITABLE_RANK_ROLES) {
     for (const k of neverGrantable) {
-      const r = await call('PUT', `/governance/roles/${role}/permissions/${k}`);
+      const r = await call('PUT', `/government/ranks/${role}/permissions/${k}`);
       assert.equal(r.status, 400, `${role} ← ${k} must be refused`);
       assert.equal(r.json.error.code, 'permission_not_grantable', `${role} ← ${k}`);
       assert.equal(calls.filter(([c]) => c === 'grantRolePermission').length, 0,
@@ -213,7 +213,7 @@ test('V2b: EVERY editable rank-role still refuses every SUBSTRATE and PRINCIPAL
 test('V2c: an editable rank-role ACCEPTS the in-app owner powers (the ADR 0172 lever)', async () => {
   for (const role of EDITABLE_RANK_ROLES) {
     for (const k of [...OWNER_POWERS, 'idea.triage']) {
-      const r = await call('PUT', `/governance/roles/${role}/permissions/${k}`);
+      const r = await call('PUT', `/government/ranks/${role}/permissions/${k}`);
       assert.equal(r.status, 200, `${role} ← ${k} must be ACCEPTED — this delegation is the owner's decision (ADR 0172)`);
       assert.equal(calls.filter(([c]) => c === 'grantRolePermission').length, 1, `${role} ← ${k} must reach the db`);
     }
@@ -222,7 +222,7 @@ test('V2c: an editable rank-role ACCEPTS the in-app owner powers (the ADR 0172 l
 
 test('V2d: reset restores the CATALOG seed, never anything wider', async () => {
   for (const role of EDITABLE_RANK_ROLES) {
-    const r = await call('POST', `/governance/roles/${role}/reset`);
+    const r = await call('POST', `/government/ranks/${role}/reset`);
     assert.equal(r.status, 200, `${role} must be resettable`);
     const [, args] = calls.find(([c]) => c === 'resetRoleGrants');
     assert.deepEqual([...args.permissionKeys].sort(), [...catalog.seedForRank(role)].sort(),
@@ -233,24 +233,24 @@ test('V2d: reset restores the CATALOG seed, never anything wider', async () => {
   }
   // A custom role has no catalog default, so reset is refused rather than silently
   // clearing its grants (which would be a destructive verb wearing a restore's name).
-  const r = await call('POST', '/governance/roles/custom-role/reset');
+  const r = await call('POST', '/government/ranks/custom-role/reset');
   assert.equal(r.status, 400);
-  assert.equal(r.json.error.code, 'role_has_no_default');
+  assert.equal(r.json.error.code, 'rank_has_no_default');
   assert.equal(calls.filter(([c]) => c === 'resetRoleGrants').length, 0);
 });
 
 test('V3: EVERY seeded rank-role refuses assignment (rank is the only writer — R95b)', async () => {
   for (const role of SEEDED_ROLES) {
-    const r = await call('POST', '/governance/assignments', { builder_id: 7, role_key: role });
+    const r = await call('POST', '/government/assignments', { builder_id: 7, rank_key: role });
     assert.equal(r.status, 403, `assigning seeded role ${role} must be refused`);
-    assert.equal(r.json.error.code, 'seeded_role_assignment_forbidden', role);
+    assert.equal(r.json.error.code, 'seeded_rank_assignment_forbidden', role);
     assert.equal(calls.filter(([c]) => c === 'assignRole').length, 0);
   }
 });
 
 test('V4: mass-assignment on role create is refused outright (strict schema)', async () => {
-  const r = await call('POST', '/governance/roles', {
-    role_key: 'sneaky-role',
+  const r = await call('POST', '/government/ranks', {
+    rank_key: 'sneaky-role',
     label: 'Sneaky',
     is_system: true,
     seeded_rank: 'archon',
@@ -262,32 +262,32 @@ test('V4: mass-assignment on role create is refused outright (strict schema)', a
 });
 
 test('V4: a clean role create is never system and carries no grants', async () => {
-  const r = await call('POST', '/governance/roles', { role_key: 'sneaky-role', label: 'Sneaky' });
+  const r = await call('POST', '/government/ranks', { rank_key: 'sneaky-role', label: 'Sneaky' });
   assert.equal(r.status, 201);
   assert.equal(r.json.role.is_system, false, 'a created role is never system');
   assert.equal(r.json.role.seeded_rank, null);
   assert.deepEqual(r.json.role.permissions, [], 'creation carries no grants');
   const c = calls.find(([k]) => k === 'createRole');
-  assert.deepEqual(Object.keys(c[1]).sort(), ['createdBy', 'description', 'label', 'roleKey'],
+  assert.deepEqual(Object.keys(c[1]).sort(), ['createdBy', 'description', 'label', 'rankKey'],
     'nothing beyond the four whitelisted fields reaches the db');
   assert.equal(calls.filter(([k]) => k === 'grantRolePermission').length, 0);
 });
 
-test('V5: a caller without governance.manage cannot reach ANY write vector at all', async () => {
-  grant(catalog.grantableKeys().filter((k) => k !== 'governance.manage'));
+test('V5: a caller without government.manage cannot reach ANY write vector at all', async () => {
+  grant(catalog.grantableKeys().filter((k) => k !== 'government.manage'));
   for (const [method, p, body] of [
-    ['POST', '/governance/roles', { role_key: 'x-role', label: 'X' }],
-    ['PUT', '/governance/roles/custom-role/permissions/deploy.push_main', undefined],
-    ['DELETE', '/governance/roles/custom-role/permissions/idea.triage', undefined],
-    ['POST', '/governance/roles/metic/reset', undefined],
-    ['POST', '/governance/assignments', { builder_id: 7, role_key: 'custom-role' }],
-    ['DELETE', '/governance/assignments/7/custom-role', undefined],
+    ['POST', '/government/ranks', { rank_key: 'x-role', label: 'X' }],
+    ['PUT', '/government/ranks/custom-role/permissions/deploy.push_main', undefined],
+    ['DELETE', '/government/ranks/custom-role/permissions/idea.triage', undefined],
+    ['POST', '/government/ranks/metic/reset', undefined],
+    ['POST', '/government/assignments', { builder_id: 7, rank_key: 'custom-role' }],
+    ['DELETE', '/government/assignments/7/custom-role', undefined],
   ]) {
     const r = await call(method, p, body);
     assert.equal(r.status, 403, `${method} ${p} must deny — even holding every operational grant`);
     assert.equal(r.json.error.code, 'permission_forbidden', `${method} ${p}`);
   }
-  grant(['governance.manage']);
+  grant(['government.manage']);
 });
 
 // ===========================================================================

package/tests/governance_catalog.mjs

@@ -57,7 +57,7 @@ test('substrate keys are the out-of-band three, and each implies system + archon
     assert.equal(byKey(k).floor, 'archon', `${k} must floor at archon`);
     assert.equal(byKey(k).principal, null, `${k} must not also be a principal key`);
   }
-  assert.equal(cat.isSubstrate('governance.manage'), false, 'an in-app archon power is not substrate');
+  assert.equal(cat.isSubstrate('government.manage'), false, 'an in-app archon power is not substrate');
   assert.equal(cat.isSubstrate('nope.not.a.key'), false, 'unknown fails closed');
 });
 
@@ -67,7 +67,7 @@ test('isGrantableTo: a sub-Archon rank-role takes owner powers, a custom role do
   const custom = { is_system: false, seeded_rank: null };
 
   // The widening: an in-app archon power reaches a rank-role, never a custom one.
-  for (const k of ['governance.manage', 'builder.rank.set', 'version.close']) {
+  for (const k of ['government.manage', 'builder.rank.set', 'version.close']) {
     assert.equal(cat.isGrantableTo(k, metic), true, `${k} → metic rank-role`);
     assert.equal(cat.isGrantableTo(k, custom), false, `${k} → custom role must stay refused`);
   }
@@ -173,7 +173,7 @@ test('an unknown/reserved rank resolves to no permissions (fail-closed; ADR 0151
 });
 
 test('byKey returns a frozen record or null', () => {
-  const p = byKey('governance.manage');
+  const p = byKey('government.manage');
   assert.ok(p && p.system === true && p.floor === 'archon');
   assert.throws(() => { p.system = false; }, /Cannot assign|read only|frozen/i);
   assert.equal(byKey('nope'), null);

package/tests/governance_fold.mjs

@@ -121,7 +121,7 @@ test('the kernel shape guard: the real fragment embeds; a malformed one degrades
   assert.equal(dbKernel.sessionPermsSelect(), '', 'a fragment with a statement separator is refused');
   // The REAL registered fragment passes the guard verbatim.
   seams._reset();
-  const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'government', 'routes', 'governance.js'));
+  const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'government', 'routes', 'government.js'));
   buildGovernanceRouter();
   const real = seams.resolveOptional('session-grants-sql').selectFragment;
   assert.equal(dbKernel.sessionPermsSelect(), real, 'the shipped fragment embeds unchanged');
@@ -133,7 +133,7 @@ test('the module registers the capability-named SQL seam the kernel embeds', ()
   // §Decision #4); the governance route factory is what registers it. Pin the
   // registration and the column contract the kernel query depends on.
   seams._reset();
-  const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'government', 'routes', 'governance.js'));
+  const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'government', 'routes', 'government.js'));
   buildGovernanceRouter();
   const provider = seams.resolveOptional('session-grants-sql');
   assert.ok(provider && typeof provider.selectFragment === 'string', 'fragment provider registered');

package/tests/governance_fold_bench.mjs

@@ -1,7 +1,7 @@
 // tests/governance_fold_bench.mjs — the task-1002556 benchmark, re-runnable.
 //
 // Measures end-to-end latency of a requireBuilder + requirePermission route
-// (GET /governance/roles) against a LIVE server, the way the fold was graded:
+// (GET /government/ranks) against a LIVE server, the way the fold was graded:
 // point it at a stack before and after and compare. Asserts only route health
 // (every request 200) — the numbers are the deliverable, printed for the
 // operator to diff.
@@ -27,7 +27,7 @@ import { strict as assert } from 'node:assert';
 const BASE = (process.env.GDS_BASE_URL || '').replace(/\/$/, '');
 const TOKEN = process.env.BENCH_TOKEN || '';
 if (!BASE || !TOKEN) {
-  console.log('governance_fold_bench.mjs SKIPPED — set GDS_BASE_URL and BENCH_TOKEN (a session token whose builder holds governance.manage).');
+  console.log('governance_fold_bench.mjs SKIPPED — set GDS_BASE_URL and BENCH_TOKEN (a session token whose builder holds government.manage).');
   process.exit(0);
 }
 const N = Number(process.env.BENCH_N) || 300;

package/tests/governance_live_proof.mjs

@@ -142,7 +142,7 @@ try {
     'BEFORE: the thetes builder cannot triage (403 permission_forbidden)');
 
   // Act 2 — an Archon creates a custom role and grants the operational permission.
-  r = await call(ARCHON_TOKEN, 'POST', '/governance/roles',
+  r = await call(ARCHON_TOKEN, 'POST', '/government/ranks',
     { role_key: ROLE_KEY, label: 'GLP demo triage role' });
   ok(r.status === 201, 'the Archon creates a custom role (201)');
   r = await call(ARCHON_TOKEN, 'PUT', `/governance/roles/${ROLE_KEY}/permissions/${OPERATIONAL_KEY}`);
@@ -153,13 +153,13 @@ try {
   r = await call(ARCHON_TOKEN, 'PUT', `/governance/roles/${ROLE_KEY}/permissions/${SYSTEM_KEY}`);
   ok(r.status === 400 && r.body.error.code === 'permission_not_grantable',
     `system '${SYSTEM_KEY}' is NOT grantable, even by the Archon (400 permission_not_grantable)`);
-  r = await call(ARCHON_TOKEN, 'PUT', `/governance/roles/${ROLE_KEY}/permissions/governance.manage`);
+  r = await call(ARCHON_TOKEN, 'PUT', `/governance/roles/${ROLE_KEY}/permissions/government.manage`);
   ok(r.status === 400 && r.body.error.code === 'permission_not_grantable',
-    'the meta-escalation (governance.manage) is refused the same way');
+    'the meta-escalation (government.manage) is refused the same way');
 
   // Act 4 — assign, then the same builder performs the action: no re-login, no
   // restart — the per-request, uncached resolve (ADR 0016) picks the role up.
-  r = await call(ARCHON_TOKEN, 'POST', '/governance/assignments',
+  r = await call(ARCHON_TOKEN, 'POST', '/government/assignments',
     { builder_id: THETES, role_key: ROLE_KEY });
   ok(r.status === 201, 'the Archon assigns the custom role to the thetes builder (201)');
   r = await call(THETES_TOKEN, 'PATCH', `/inbox/${ideaId}`, { status: 'discarded' });

package/tests/governance_ownership_scope.mjs

@@ -397,7 +397,7 @@ test('G2: the role resolve is untouched — own-scoped keys still resolve, princ
 });
 
 test('G3: the kernel port carries the ownership axis on the ONE governance port', () => {
-  const { governancePort } = require(path.join(GOV, 'routes', 'governance.js'));
+  const { governancePort } = require(path.join(GOV, 'routes', 'government.js'));
   for (const name of ['authorizeOwned', 'authorizeOwnedOrAny', 'sameOwner', 'isOwnershipScoped', 'crossOwnerKeysFor']) {
     assert.equal(typeof governancePort[name], 'function', `the port must expose ${name}`);
   }

package/tests/governance_page_gates.mjs

@@ -58,7 +58,7 @@ const LIVE_RANKS = ['xenos', 'thetes', 'metic', 'archon'];
 // requireNonXenosPage   admitted rank !== 'xenos'       → thetes and up
 // requireGovernancePage admitted rank === 'archon'      → archon only …until ADR 0157
 //
-// ADR 0157 (owner decision, 2026-08-05) lowered `page.view.governance` archon→metic, so
+// ADR 0157 (owner decision, 2026-08-05) lowered `page.view.government` archon→metic, so
 // the monitoring pages (/watch, /harbor, /gate) now open to the working rank. That gate
 // was spelled `requireArchonPage` through R107 and ADR 0157 — the name the rows below
 // were first written against — and was renamed once the floor moved; the audience here,
@@ -86,7 +86,7 @@ const DENIED_TO = {
 const GATE_PERMISSION = {
   requireBuilderPage: 'page.view.public',
   requireNonXenosPage: 'page.view.builder',
-  requireGovernancePage: 'page.view.governance',
+  requireGovernancePage: 'page.view.government',
 };
 const deniedLoc = (gate, { unavailable = false } = {}) =>
   `${DENIED_TO[gate]}?denied=${GATE_PERMISSION[gate]}${unavailable ? '&reason=unavailable' : ''}`;
@@ -94,7 +94,7 @@ const deniedLoc = (gate, { unavailable = false } = {}) =>
 const GATE_FLOOR = {
   requireBuilderPage: 'xenos',
   requireNonXenosPage: 'thetes',
-  // ADR 0157: `page.view.governance` floor archon→metic.
+  // ADR 0157: `page.view.government` floor archon→metic.
   requireGovernancePage: 'metic',
 };
 const SIGN_IN = '/api/gds/auth/web/start';
@@ -264,7 +264,7 @@ test('B4: the page gates resolve per request — no memoised authority (ADR 0016
 test('B5: every permission a page gate names is a real catalog key', async () => {
   // Not an oracle — a sanity check that the gates did not migrate onto a typo,
   // which would silently deny everyone (fail-closed, but a bug all the same).
-  for (const key of ['page.view.public', 'page.view.builder', 'page.view.governance']) {
+  for (const key of ['page.view.public', 'page.view.builder', 'page.view.government']) {
     assert.ok(catalog.byKey(key), `${key} must exist in the catalog`);
   }
 });